Skip to content

Commit 33e4f7f

Browse files
ildar-khisambeevildar-khisambeev
committed
use security printer (#3603)
1 parent 0f17438 commit 33e4f7f

File tree

14 files changed

+71
-43
lines changed

14 files changed

+71
-43
lines changed

‎ydb/core/client/server/grpc_server.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ class TSimpleRequest
265265

266266
void Finish(const TOut& resp, ui32 status) {
267267
LOG_DEBUG(ActorSystem, NKikimrServices::GRPC_SERVER, "[%p] issuing response Name# %s data# %s peer# %s", this,
268-
Name, NYdbGrpc::FormatMessage(resp).data(), GetPeerName().c_str());
268+
Name, NYdbGrpc::FormatMessage<TOut>(resp).data(), GetPeerName().c_str());
269269
ResponseSize = resp.ByteSize();
270270
ResponseStatus = status;
271271
StateFunc = &TSimpleRequest::FinishDone;
@@ -292,7 +292,7 @@ class TSimpleRequest
292292
OnAfterCall();
293293

294294
LOG_DEBUG(ActorSystem, NKikimrServices::GRPC_SERVER, "[%p] received request Name# %s ok# %s data# %s peer# %s current inflight# %li", this,
295-
Name, ok ? "true" : "false", NYdbGrpc::FormatMessage(Request, ok).data(), GetPeerName().c_str(), Server->GetCurrentInFlight());
295+
Name, ok ? "true" : "false", NYdbGrpc::FormatMessage<TIn>(Request, ok).data(), GetPeerName().c_str(), Server->GetCurrentInFlight());
296296

297297
if (Context.c_call() == nullptr) {
298298
Y_ABORT_UNLESS(!ok);

‎ydb/core/grpc_streaming/grpc_streaming.h

+3-3
Original file line numberDiff line numberDiff line change
@@ -349,7 +349,7 @@ class TGRpcStreamingRequest final
349349
LOG_DEBUG(ActorSystem, LoggerServiceId, "[%p] read finished Name# %s ok# %s data# %s peer# %s",
350350
this, Name,
351351
status == NYdbGrpc::EQueueEventStatus::OK ? "true" : "false",
352-
NYdbGrpc::FormatMessage(ReadInProgress->Record, status == NYdbGrpc::EQueueEventStatus::OK).c_str(),
352+
NYdbGrpc::FormatMessage<TIn>(ReadInProgress->Record, status == NYdbGrpc::EQueueEventStatus::OK).c_str(),
353353
this->GetPeerName().c_str());
354354

355355
// Take current in-progress read first
@@ -390,14 +390,14 @@ class TGRpcStreamingRequest final
390390
if (status) {
391391
LOG_DEBUG(ActorSystem, LoggerServiceId, "[%p] facade write Name# %s data# %s peer# %s grpc status# (%d) message# %s",
392392
this, Name,
393-
NYdbGrpc::FormatMessage(message).c_str(),
393+
NYdbGrpc::FormatMessage<TOut>(message).c_str(),
394394
this->GetPeerName().c_str(),
395395
static_cast<int>(status->error_code()),
396396
status->error_message().c_str());
397397
} else {
398398
LOG_DEBUG(ActorSystem, LoggerServiceId, "[%p] facade write Name# %s data# %s peer# %s",
399399
this, Name,
400-
NYdbGrpc::FormatMessage(message).c_str(),
400+
NYdbGrpc::FormatMessage<TOut>(message).c_str(),
401401
this->GetPeerName().c_str());
402402
}
403403

‎ydb/core/persqueue/partition_monitoring.cpp

+10-1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
#include <ydb/core/protos/counters_pq.pb.h>
1313
#include <ydb/core/protos/msgbus.pb.h>
1414
#include <ydb/library/persqueue/topic_parser/topic_parser.h>
15+
#include <ydb/library/protobuf_printer/security_printer.h>
1516
#include <ydb/public/lib/base/msgbus.h>
1617
#include <library/cpp/html/pcdata/pcdata.h>
1718
#include <library/cpp/monlib/service/pages/templates.h>
@@ -22,6 +23,14 @@
2223

2324
namespace NKikimr::NPQ {
2425

26+
TString PrintConfig(const NKikimrPQ::TPQTabletConfig& cfg) {
27+
TSecurityTextFormatPrinter<NKikimrPQ::TPQTabletConfig> printer;
28+
printer.SetSingleLineMode(true);
29+
TString string;
30+
printer.PrintToString(cfg, &string);
31+
return string;
32+
}
33+
2534
void HtmlOutput(IOutputStream& out, const TString& line, const std::deque<std::pair<TKey, ui32>>& keys) {
2635
HTML(out) {
2736
TABLE() {
@@ -109,7 +118,7 @@ void TPartition::HandleMonitoring(TEvPQ::TEvMonRequest::TPtr& ev, const TActorCo
109118
out << "AvgWriteSize per " << avg.GetDuration().ToString() << " is " << avg.GetValue() << " bytes";
110119
res.push_back(out.Str()); out.Clear();
111120
}
112-
out << Config.DebugString(); res.push_back(out.Str()); out.Clear();
121+
out << PrintConfig(Config); res.push_back(out.Str()); out.Clear();
113122
HTML(out) {
114123
DIV_CLASS_ID("tab-pane fade", Sprintf("partition_%u", ui32(Partition))) {
115124
TABLE_SORTABLE_CLASS("table") {

‎ydb/core/persqueue/ya.make

+1
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ PEERDIR(
5959
ydb/library/logger
6060
ydb/library/persqueue/counter_time_keeper
6161
ydb/library/persqueue/topic_parser
62+
ydb/library/protobuf_printer
6263
ydb/public/lib/base
6364
ydb/public/sdk/cpp/client/ydb_persqueue_core
6465
)

‎ydb/core/protos/flat_tx_scheme.proto

+2-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import "ydb/core/protos/bind_channel_storage_pool.proto";
77
import "ydb/core/protos/flat_scheme_op.proto";
88
import "ydb/public/api/protos/ydb_cms.proto";
99
import "ydb/public/api/protos/ydb_issue_message.proto";
10+
import "ydb/public/api/protos/annotations/sensitive.proto";
1011

1112
package NKikimrScheme;
1213
option java_package = "ru.yandex.kikimr.proto";
@@ -53,7 +54,7 @@ message TEvModifySchemeTransaction {
5354
optional uint64 TabletId = 3;
5455
optional string Owner = 5;
5556
optional bool FailOnExist = 6; // depricated, TModifyScheme.FailOnExist is recomended
56-
optional string UserToken = 7; // serialized NACLib::TUserToken
57+
optional string UserToken = 7 [(Ydb.sensitive) = true]; // serialized NACLib::TUserToken
5758
optional string PeerName = 8;
5859
}
5960

‎ydb/core/protos/pqconfig.proto

+5-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
import "ydb/public/api/protos/draft/persqueue_error_codes.proto";
22
import "ydb/public/api/protos/draft/persqueue_common.proto";
33

4+
import "ydb/public/api/protos/annotations/sensitive.proto";
5+
46
import "ydb/core/protos/base.proto";
57
import "ydb/core/protos/msgbus_kv.proto";
68
import "ydb/core/protos/node_limits.proto";
@@ -208,11 +210,11 @@ message TMirrorPartitionConfig {
208210
message TCredentials {
209211
message IamCredentials {
210212
optional string Endpoint = 1;
211-
optional string ServiceAccountKey = 2;
213+
optional string ServiceAccountKey = 2 [(Ydb.sensitive) = true];
212214
}
213215
oneof Credentials {
214-
string OauthToken = 1;
215-
string JwtParams = 2;
216+
string OauthToken = 1 [(Ydb.sensitive) = true];
217+
string JwtParams = 2 [(Ydb.sensitive) = true];
216218
IamCredentials Iam = 3;
217219
}
218220
}

‎ydb/core/tx/schemeshard/schemeshard__operation.cpp

+13-3
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
#include <ydb/core/tablet_flat/flat_cxx_database.h>
1313
#include <ydb/core/tablet_flat/tablet_flat_executor.h>
1414

15+
#include <ydb/library/protobuf_printer/security_printer.h>
16+
1517
#include <util/generic/algorithm.h>
1618

1719
namespace NKikimr::NSchemeShard {
@@ -85,6 +87,14 @@ NKikimrScheme::TEvModifySchemeTransaction GetRecordForPrint(const NKikimrScheme:
8587
return recordForPrint;
8688
}
8789

90+
TString PrintSecurely(const NKikimrScheme::TEvModifySchemeTransaction& record) {
91+
TSecurityTextFormatPrinter<NKikimrScheme::TEvModifySchemeTransaction> printer;
92+
printer.SetSingleLineMode(true);
93+
TString string;
94+
printer.PrintToString(record, &string);
95+
return string;
96+
}
97+
8898
THolder<TProposeResponse> TSchemeShard::IgniteOperation(TProposeRequest& request, TOperationContext& context) {
8999
THolder<TProposeResponse> response = nullptr;
90100

@@ -183,7 +193,7 @@ THolder<TProposeResponse> TSchemeShard::IgniteOperation(TProposeRequest& request
183193
<< ", already accepted parts: " << operation->Parts.size()
184194
<< ", propose result status: " << NKikimrScheme::EStatus_Name(response->Record.GetStatus())
185195
<< ", with reason: " << response->Record.GetReason()
186-
<< ", tx message: " << GetRecordForPrint(record).ShortDebugString());
196+
<< ", tx message: " << PrintSecurely(record));
187197
}
188198

189199
Y_VERIFY_S(context.IsUndoChangesSafe(),
@@ -194,7 +204,7 @@ THolder<TProposeResponse> TSchemeShard::IgniteOperation(TProposeRequest& request
194204
<< ", already accepted parts: " << operation->Parts.size()
195205
<< ", propose result status: " << NKikimrScheme::EStatus_Name(response->Record.GetStatus())
196206
<< ", with reason: " << response->Record.GetReason()
197-
<< ", tx message: " << GetRecordForPrint(record).ShortDebugString());
207+
<< ", tx message: " << PrintSecurely(record));
198208

199209
context.OnComplete = {}; // recreate
200210
context.DbChanges = {};
@@ -237,7 +247,7 @@ struct TSchemeShard::TTxOperationPropose: public NTabletFlatExecutor::TTransacti
237247

238248
LOG_DEBUG_S(ctx, NKikimrServices::FLAT_TX_SCHEMESHARD,
239249
"TTxOperationPropose Execute"
240-
<< ", message: " << GetRecordForPrint(Request->Get()->Record).ShortDebugString()
250+
<< ", message: " << PrintSecurely(Request->Get()->Record)
241251
<< ", at schemeshard: " << selfId);
242252

243253
txc.DB.NoMoreReadsForTx();

‎ydb/core/tx/schemeshard/ya.make

+1
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,7 @@ PEERDIR(
268268
ydb/library/aclib/protos
269269
ydb/library/login
270270
ydb/library/login/protos
271+
ydb/library/protobuf_printer
271272
ydb/library/yql/minikql
272273
ydb/services/bg_tasks
273274
)

‎ydb/library/grpc/server/actors/ya.make

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ SRCS(
66

77
PEERDIR(
88
ydb/library/actors/core
9+
ydb/library/grpc/server
910
)
1011

1112
END()

‎ydb/library/grpc/server/logger.h

+6-6
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
#pragma once
22

3+
#include <ydb/library/protobuf_printer/security_printer.h>
4+
35
#include <library/cpp/logger/priority.h>
46

57
#include <util/generic/ptr.h>
68
#include <util/system/env.h>
79

8-
#include <google/protobuf/text_format.h>
9-
1010

1111
namespace NYdbGrpc {
1212

13-
static bool LogBodyEnabled = "BODY" == GetEnv("YDB_GRPC_SERVER_LOGGING");
13+
static bool LogBodyEnabled = "BODY" == GetEnv("YDB_GRPC_SERVER_LOGGING");
1414

1515
class TLogger: public TThrRefBase {
1616
protected:
@@ -46,12 +46,12 @@ using TLoggerPtr = TIntrusivePtr<TLogger>;
4646
logger->Write(ELogPriority::TLOG_INFO, format, __VA_ARGS__); \
4747
} else { }
4848

49-
50-
inline TString FormatMessage(const NProtoBuf::Message& message, bool ok = true) {
49+
template <typename TMsg>
50+
inline TString FormatMessage(const TMsg& message, bool ok = true) {
5151
if (ok) {
5252
if (LogBodyEnabled) {
5353
TString text;
54-
google::protobuf::TextFormat::Printer printer;
54+
NKikimr::TSecurityTextFormatPrinter<TMsg> printer;
5555
printer.SetSingleLineMode(true);
5656
printer.PrintToString(message, &text);
5757
return text;

‎ydb/library/grpc/server/ya.make

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ SRCS(
1010
GENERATE_ENUM_SERIALIZATION(grpc_request_base.h)
1111

1212
PEERDIR(
13+
ydb/library/protobuf_printer
1314
contrib/libs/grpc
1415
library/cpp/monlib/dynamic_counters/percentile
1516
)
1617

1718
END()
1819

1920
RECURSE_FOR_TESTS(ut)
20-

‎ydb/public/api/protos/draft/persqueue_common.proto

+4-3
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ syntax = "proto3";
22
import "google/protobuf/descriptor.proto";
33
import "ydb/public/api/protos/draft/persqueue_error_codes.proto";
44

5+
import "ydb/public/api/protos/annotations/sensitive.proto";
6+
57
package NPersQueueCommon;
68

79
option java_package = "com.yandex.ydb.persqueue";
@@ -35,8 +37,7 @@ enum ECodec {
3537

3638
message Credentials {
3739
oneof credentials {
38-
bytes tvm_service_ticket = 1;
39-
bytes oauth_token = 2;
40+
bytes tvm_service_ticket = 1 [(Ydb.sensitive) = true];
41+
bytes oauth_token = 2 [(Ydb.sensitive) = true];
4042
}
4143
}
42-

‎ydb/public/api/protos/ydb_persqueue_v1.proto

+5-4
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ import "ydb/public/api/protos/ydb_operation.proto";
33
import "ydb/public/api/protos/ydb_scheme.proto";
44
import "ydb/public/api/protos/ydb_status_codes.proto";
55
import "ydb/public/api/protos/ydb_issue_message.proto";
6+
import "ydb/public/api/protos/annotations/sensitive.proto";
67
import "ydb/public/api/protos/annotations/validation.proto";
78

89
package Ydb.PersQueue.V1;
@@ -38,7 +39,7 @@ message OffsetsRange {
3839

3940
// In-session reauthentication and reauthorization, lets user increase session lifetime. You should wait for 'update_token_response' before sending next 'update_token_request'.
4041
message UpdateTokenRequest {
41-
string token = 1;
42+
string token = 1 [(Ydb.sensitive) = true];
4243
}
4344

4445
message UpdateTokenResponse {
@@ -788,7 +789,7 @@ message MigrationStreamingReadClientMessage {
788789
}
789790

790791
// User credentials if update is needed or empty string.
791-
bytes token = 20;
792+
bytes token = 20 [(Ydb.sensitive) = true];
792793
}
793794

794795
/**
@@ -1073,8 +1074,8 @@ message Credentials {
10731074
string service_account_key = 2;
10741075
}
10751076
oneof credentials {
1076-
string oauth_token = 1;
1077-
string jwt_params = 2;
1077+
string oauth_token = 1 [(Ydb.sensitive) = true];
1078+
string jwt_params = 2 [(Ydb.sensitive) = true];
10781079
Iam iam = 3;
10791080
}
10801081
}

0 commit comments

Comments
 (0)